Privacy Policy

Revised on 7 October 2026

This document explains in simple terms what personal data we collect from you on NSP Club websites within the European Union, why we collect it, on what legal basis, to whom we disclose it, how long we retain it and what rights you have.

1. Who is responsible for your data

The data controller is Dina Pavlovna Sultanova, vul. Kotliarevskoho 8, 20703 Smila, Cherkasy Oblast, Ukraine (hereinafter referred to as ‘we’).

This policy applies to the websites eu.nspclub.org, nspclub.pl, nspclub.de, nspclub.fr, nspclub.es, nspclub.it, nspclub.ro, nspclub.nl, nspclub.gr, nspclub.cz, nspclub.pt, nspclub.sk, nspclub.lt, nspclub.lv, nspclub.ee, nspclub.dk, nspclub.fi, as well as the online chat and the ‘Health Test’ questionnaire on these websites.

How to contact us regarding data matters: via the form on the ‘Contact’ page or by email at europe@nspclub.org. We respond to enquiries from all EU countries; replies will be in the language of your enquiry or in English.

2. What data do we collect, why, and on what basis

What we do	What data	Legal basis (GDPR)	How long we store it
Website account	first name, surname, email address, telephone number, password (as an irreversible hash), delivery addresses, discount code (if provided)	Contract — Article 6(1)(b)	for as long as the account exists; if there have been no logins or orders for 5 years, we will send a warning by email and delete the account after 30 days (retention periods for requests are set out in the next line)
Order request: to accept it, contact you, and process the order with the Seller (section 3)	name, contact details, address, order details, comments	Processing and fulfilling your order in accordance with your request — Article 6(1)(b)	Requests made via an account — for as long as the account exists (history in the user dashboard); guest requests and requests from deleted accounts — 3 years after fulfilment, after which we anonymise the data
Unsubmitted application (you have started filling in the application but have not submitted it)	name, email, telephone number, selected products	Legitimate interest — to understand why applications are not being submitted and to assist you if you contact us — Article 6(1)(f). We do not write to you or call you regarding unsubmitted applications without your consent.	up to 90 days
A reminder about an unsent request is a single email, provided that you ticked the box ‘Remind me once by email if I do not complete the request’ when placing the order.	email address, name, selected products, shop page and language; date, time and IP address of consent	Consent — Article 6(1)(a); you may withdraw your consent at any time — simply untick the box, reply to the email or contact us using the details in section 1	letter — once; data — together with the unsent request, for up to 90 days
Login via Facebook or Google (including Google’s one-click quick login)	account ID, name, email address (the information you have authorised the social network to share)	Contract — Article 6(1)(b)	for as long as the account exists or until you de-link it
Online chat and messaging services: to answer your questions	name, contact details, correspondence, attachments and voice messages	Contract/request — Article 6(1)(b); legitimate interest in answering questions — Article 6(1)(f)	3 years after the last message
Online chat: operation of the chat window on the website’s pages	IP address, approximate location (town), browser, page viewed — stored when you visit the website, even if you do not use the chat	legitimate interest in ensuring the chat function works — Article 6(1)(f)	3 years
Messages from the ‘Contact’ and ‘Returns’ forms and emails sent to us	name, email address, text, order number	Contract / legitimate interest — Article 6(1)(b), (f)	3 years after the correspondence has ended
Health test	answers regarding your health and test results — health data; name, email address, telephone number (if provided) and discount code	your explicit consent — Article 6(1)(a) and 9(2)(a), separate tick box	The result is sent to you and to us by email; we retain it in our records for up to 3 years
Feedback and comments	Name (as provided by you), text, rating, email address, IP address	Legitimate interest in publishing reviews — Article 6(1)(f)	Whilst published; when data is deleted, we anonymise it: we remove the name, email address and IP address, and, where necessary, any information in the text that could identify the author
Newsletter	email, name, language, country, discount code. Contact details of customers with an account are stored in our newsletter system on our server; promotional emails are sent only to those who have consented to receive them	Consent — Article 6(1)(a): the ‘Subscribe’ tick box	until unsubscribed (link in every email)
Affiliate programme: which of NSP Club’s affiliates recommended the website to you	partner number and date of the first click on their link — stored in the cookies tracking and nsp_track_since; the partner number is also stored in your application, account and messages sent via the ‘Contact’ form	legitimate interest — to take the partner’s recommendation into account — Article 6(1)(f); a cookie is set when you click on the partner’s link	Cookie — 1,000 days (approximately 2.7 years); in the application and account — for the periods specified (see above)
Visitor statistics (Google Analytics)	browser ID, pages viewed, device, approximate location	Consent — Article 6(1)(a)	up to 14 months
Website security and operation	IP address, date and time, browser, server logs; account login logs (email, IP); form protection against spam (Cloudflare Turnstile — activated only when you start filling in a form)	legitimate interest — Article 6(1)(f)	server logs — up to 90 days; login logs — up to 1 year

We do not sell your data or use it for decisions that give rise to legal consequences for you. The health test result is calculated automatically based on your answers; it is a guide, not a medical opinion, and does not affect your rights or contracts.

Some of the replies in the online chat are provided by an automated assistant powered by artificial intelligence. You can always ask for a reply from a member of staff. Please do not disclose unnecessary information about your health in the chat; if you do, we will only use it to reply to you.

3. Who we share data with

Nature’s Sunshine Europe Sp. z o.o. (Warsaw, Poland) is the seller of the goods. To process your order, we pass on your name, contact details, address and order details to them. It then processes this data as an independent data controller — determining the purposes and methods of processing itself — in accordance with its privacy policy (payment, delivery, sales records, customer number, and assignment to an NSP Club adviser).
Delivery services (UPS, GLS, DPD, InPost, Venipak, etc.) receive data from Nature’s Sunshine Europe, not from us.
The NSP Club partner whose link you used to access the site receives your health test results and your contact details only if you have specifically consented to this in the test questionnaire.
Our data processors act solely on our instructions:
Hetzner Online GmbH (Germany) – servers in Germany and Finland on which the websites, chat, email and mailing system operate;
Contabo GmbH (Germany) — a test server in France;
Google (Ireland/USA) — Google Tag Manager (loaded on all pages and only activates Google Analytics once you have given your consent), Google Analytics (only with your consent), Google Sign-in, backup storage (Google Drive);
Cloudflare (USA) — delivery of messenger button images; protection of forms against spam (Cloudflare Turnstile);
OpenAI (USA) — automatic translation of chat messages, recognition of voice messages and images, responses from the automated assistant;
Pusher (UK) — a chat indicator showing that a member of staff is available.
Messaging apps and social media platforms are independent data controllers; their policies apply when you use them: Meta Platforms Ireland (login via Facebook; WhatsApp, Messenger, Instagram), Telegram, Viber. Messages are also stored by the messaging services themselves; the ability to delete them there depends on the service’s features, and deleting a message in your app does not always delete the copy on the other person’s device.
Embedded videos. Some product descriptions and articles feature videos from YouTube (Google Ireland). When you open such a page, YouTube receives your IP address and may set its own cookies.
Government authorities — only upon lawful request.

4. Transfer of data outside the EU

Ukraine. We are based in Ukraine: the data you submit via the website is received by us and stored on servers in the EU, whilst we process it from Ukraine. There is no European Commission decision on adequate protection for Ukraine. The GDPR applies to us in full (Article 3(2)), and we protect your data as described in Section 9.
USA (Google, Cloudflare, OpenAI). The transfer is based on the European Commission’s decision on the EU-US Data Privacy Framework for certified companies, and otherwise on the European Commission’s standard contractual clauses. A copy of these safeguards can be requested by emailing europe@nspclub.org.
United Kingdom (Pusher) — pursuant to the European Commission’s decision on adequate protection.

The servers hosting the website databases are located in the EU (Germany, Finland).

5. Cookies and similar technologies

We only set cookies for visitor statistics and Google Quick Sign-in with your consent. Without your consent, we set cookies that are necessary for the website to function and for the features you use, as well as affiliate programme cookies if you arrived via an affiliate link. Below is a full list of cookies and data that the website stores in your browser.

Cookies	Who sets them	Why	Duration	Consent required
OCSESSID (PHPSESSID)	We	Shopping basket, log in	until the browser is closed	No — required
language, currency, languager, languageauto, auto_country	We	language, currency and country; your response to the language prompt	30 days, languageauto — 180 days	No — required
kg_consent_preferences	We	Remember your choice in the cookie pop-up	12 months	No — required
nsp_discount_card	we	a discount based on the discount code you entered	30 days	No — required for the discount you have requested
sociallogin_country_code	we	Log in via social media: do not ask for the phone country code again	30 days	No — required
xds_viewed_products	We	‘You’ve viewed’ list (product numbers only)	until the browser is closed	No
hide_linkbar and browser storage	we	remember the page settings you have selected: product list view, filters, and the collapsed partner links panel	until you close your browser; browser storage — until you delete the website’s data	No — your choice
tracking, nsp_track_since	we	Affiliate programme: which partner referred you and when (section 2)	1,000 days	No — set when you click on a partner’s link
_ga, _ga_*	Google Analytics	visitor statistics	up to 2 years	Yes
g_state	Google	Google Quick Sign-in: to remember that you have closed the sign-in window	up to 6 months	Yes — the quick sign-in window only appears once consent has been given
sb-login and browser storage (support-board, pusherTransportTLS)	online chat (chat.nspclub.org, Pusher)	to recognise you on your next visit and display your chat history	sb-login — up to 10 years; browser storage — until you delete the website data	No — set when the page is opened; required for the chat to work

You can accept or decline cookies in the cookie pop-up window on your first visit and can change your settings at any time via the ‘Cookie settings’ link at the bottom of the page. Declining cookies does not restrict the functionality of the website. You can delete any cookies in your browser settings. Embedded YouTube videos (section 3) may set cookies for their own service.

6. Your rights

You have the right to:

to find out what personal data we hold about you and to obtain a copy of it (Article 15);
correct inaccurate data (Article 16) — most of this can be corrected in your account;
Request erasure (Article 17) — see the procedure on the page ‘Personal data deletion’;
restrict processing (Article 18);
to receive the data you have provided to us in a machine-readable format or to request that it be transferred to another controller, provided that the processing is based on consent or a contract and is carried out by automated means (Article 20);
object to processing (Article 21) — see below for further details;
to withdraw consent at any time — for the newsletter, statistical cookies and Google Quick Sign-in, and the processing of test results — without affecting previous processing;
submit a complaint to your country’s data protection supervisory authority (for example, in Germany — the authority in your federal state; in Spain — the AEPD; in Poland — the UODO).

Right to object (Article 21). You may, at any time, on grounds relating to your particular situation, object to the processing of your data on the basis of a legitimate interest (Article 6(1)(f)). You may object at any time, without giving any reason, to the use of your data for direct marketing, including for mailing lists; thereafter, we will no longer use your data for this purpose.

We respond to enquiries within one month. If we have reasonable doubts as to whether the enquiry was sent by you, we may ask you to confirm it — for example, via the email address you have provided to us, or by another suitable means.

7. Is it compulsory to provide personal data?

To place an order, we need your name, contact details and address — without these, we will not be able to pass the order on to the Seller or deliver it. Account registration, social media login, newsletter, health assessment, chat and reviews — these are optional, but for each of these functions, you’ll need to provide the details marked as mandatory on the relevant form. Technical data, such as your IP address, is transmitted automatically when you visit the website (section 2, ‘Security and website operation’).

8. Children

This website is not intended for persons under the age of 16. If you become aware that a child has provided us with data without their parents’ consent, please contact us — we will delete it.

9. How we protect your data

Connections to the website are encrypted (HTTPS), passwords are stored as irreversible hashes, access to data is restricted to those who need it for work, servers are located in data centres within the EU, and backups are rotated regularly.

10. Changes

We update this policy when our services or the law change. The revision date is shown at the top. We will announce any significant changes on the website.